Quote:
Herko Coomans wrote:
...
Shame you pass up on that and just be *like* a grumpy old man mumbling about, accusing me of lying, ignorance and/or being incompetent without giving any kind of evidence of you being anything to the contrary.
Hmmm... One hint for you: "Don’t trouble trouble till trouble troubles you". Providing, Hosting, Networing is
my business in different aspects, not your or Scalpa's. Before repeating spmething, that you can't grok, better to ask qualified explanation from proffessional (maybe you'll even get it free)
Wel, go to facts...it will be long "quoting-answer" story...
Quote:
Many shared hosting providers do not run each account under a separate apache instance,
All ordinary shared hostings use
one instance of process Apache, otherwise it's called "VDS" - Virual Dedicated Servers - in singehost
Quote:
but use the default 'apache' user and group created on initial install, and use a vhost for each website on that server.Apache runs under this special credentials for all those websites.
Yes, but "What???" One httpd-process for all supported sites, under any user rights isn't a problem at all. One apache for each client is... hmmm... not low-cost solution. and give small advantages and huge set of headaches.
Quote:
So where you need to give your application "write access" you need to give this "apache" user write access
Only if we speak about (in our case) PHP as Apache's module, which works with Apache privileges... And it is totally incorrect if
- PHP used as CGI (I hate this solution)
- PHP's cgi is suexec'ed
Quote:
(generally it means: making the folder world-writable).
Delirium - it NEVER means "world writable"... it means "Apache process must have rights to write in some physical location" and NOTHING more
Quote:
If the owner had write access, it wouldn't mean anything to the "apache" user, and PHP wouldn't be able to write anything.
Small introduction into real multiuser systems and multilevel rights concept for you.
In case of some unrelated areas, which can be handled by different independent users we can't (due to privacy and security reasons) allow all our customers work as single local user, thus - every customer is at least one users with own environment, home, rights. Second problem is (for us) is ability to interact every this user with some backside power (also independent user in terms of our system) and possibilities to
share some rigths for results of work man and daemon (see some string above - both have own rigths, we are in trouble "how to share"). But we
can do it... We must know, that
- every object (with some level of iteration) have 2-level of ownership - owner and group, every user (except of fact it's user) also is member of at least one
union - group, and if we can integrate rights on minimalistic level (owner), we can expand it to next level - user's group... this way more than one user can get same rights on some object (file)....
Okay, what we see as result of our tour? We can in most cases
- include users ( with FTP or SSH access) into the same group, under which operate apache-process owner on our host
- make user (customer's users) owner of all his files on site
- give group write access only to files-directories, which (can|have to) be changed by apache user
- create jail for all customer's users (they can't move up on tree outside own home, which contain site and... nothing more)
WHERE you, Herko-Scalpa-other <censored>, see mandatory requirements to write access to World (any process)???
Quote:
Now, what happens is that all the websites that run on the same shared server, run under this "apache" user... So where you give write access to apache, you're giving write access to EVERY malicious user sharing the same server.
Never say "user"... every process on this host, and only if lame configuration was created and used... as I shown above... And it's good - principle LMD-DML in action
Quote:
Now, is this a XOOPS problem or not? I say no
Agree, but for different reasons... Lamers is problem - everywhere for everybody...
Quote:
The solution to this is to have each site run under a different apache user, using suexec.
You are naive dreamer... 100-200-500 addintional apache processes?! Will you pay for it? Do
you ready to pay for such hosting VDS cost?
Quote:
So there you have it, the complete motivation for that single line you quoted.
Full of errors, misinterpretation, just missing logic sometimes
Quote:
I hope it will help people deal with this problem and communicate it with their hosting providers.
hope I shown to all real situation and absence good low-cost solution
OK, enough for today... I spent more time than I can at this learning course for the thankless listeners
